Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you trust that your personal machine is not compromised?

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 469 posts

Re: Ask HN: How do you trust that your personal machine is not compromised?

#151

Post by tigrezno »

amelius wrote: post #85
Helmut10001 wrote: post #66

Separation of concerns is a good idea. Don't run everything together, e.g. multiple boot Os, or nested OS (windows with several WSL setups for different work, test untrusted windows apps first in windows development VM etc.). If you have a server, run dedicated VMs and work on those via remote, these days you can even stream your games from your dedicated VM. In case a game is compromised, it will at maximum compromi…

A workflow that involves multiple VMs is usually very cumbersome. I feel that our OSes should solve this problem. Unix was built with the mindset that other users cannot be trusted, but they forgot that applications can also be malicious. There is a huge opportunity here for better OSes.

Isn't that the effort done on jails like snap/flatpak lately??

Re: Ask HN: How do you trust that your personal machine is not compromised?

#153

Post by mark_l_watson »

I actually don’t really trust my Linux and macOS laptops. I put no sensitive information in them, just what I need to write software or build models.

I do trust iOS and iPadOS in Lockdown Mode, and I avoid installing apps, usually preferring web apps.

I have a Chromebook and I also trust that.

In all cases, I don’t wait to install available system updates - that might not be the best strategy, but that is how I do it.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#154

Post by fortran77 »

amelius wrote: post #140
Terretta wrote: post #118

Earlier quoted context omitted.

TouchID or windows machines with Windows Hello touch solves morale issue. Then they don't type most of the time and the length of 'memorable passwords' (like correct-horse4BATTERY!staple ) isn't a problem.

I suppose you could complement that with a camera + AI that recognizes when you leave your computer.

My Windows Surface unlocks with their depth-camera. I don't know if big corporations allow this sort of thing on their laptops, but it's very handy for us in our small consulting business.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#155

Post by Dma54rhs »

zython wrote: post #147
ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

What is your opinion on ios Lockdown mode ?

You cant verify but just take Apples word for it, it's not a fair comparison in my opinion.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#156

Post by hdjjhhvvhga »

NikolaNovak wrote: post #16

Great question. I don't anymore. Decades ago when I had a 286 and knew what each file did and what all the software was, and threats were limited and crude, I had good confidence of controlling my machine. Today, when my laptop has millions of files and each website - even hacker news - could inject something malicious and my surface is so broad (browsers applications extensions libraries everything) and virtually an…

> (bonus question - how to make backups safe in age of encrypting ransom ware).

This is actually a solved problem, with many solutions. In a nutshell, you need a system that has enough space to make many enough copies without overwriting the ones that are too fresh. It also must not be controllable by the host that you backup but this is kind of obvious.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#157

Post by ttctciyf »

pixxel wrote: post #145
ttctciyf wrote: post #56

Earlier quoted context omitted.

> enable anti-malware if your OS has it . . . Would be interested in hearing other things Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. For me this amounts to enabling NoScript and uBlock[edit: [0]] plugins in Firefox, desktop and mobile versions, and disabling or locking down various "features". An additiona…

I’ve no doubt you are referring to uBlock Origin but it’s real important to label it as such so the unaware don’t install uBlock.

Thanks, yes, updated.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#158

Post by amelius »

tigrezno wrote: post #151
amelius wrote: post #85

Earlier quoted context omitted.

A workflow that involves multiple VMs is usually very cumbersome. I feel that our OSes should solve this problem. Unix was built with the mindset that other users cannot be trusted, but they forgot that applications can also be malicious. There is a huge opportunity here for better OSes.

Isn't that the effort done on jails like snap/flatpak lately??

Ergonomics is part of the equation and Snap is definitely not there yet, and in fact its poor quality may be driving users to other solutions.

Snap has no GUI, where clearly a solution that provides a general sandbox should. When you open an app and click "Open File", the sandbox GUI should intervene and ask the user where the app is allowed to look.

Also, the idea of "security bolted on top" of an existing OS doesn't seem very trustworthy.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#159

Post by lrvick »

ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

IMO we have to step back and be honest that the Linux kernel is simply not equipped to run trusted code and untrusted code in the same memory. New bugs are found every few weeks.

If history is of any guide Android and ChromiumOS likely still have many critical bugs the public does not know about yet.

Sadly the only choice is to burn extra ram to give every security context a dedicated kernel and virtual machine. Hypervisors are the best sandbox that exists anchored down to a hardware IOMMU.

QubesOS being VM based is thus the best effort secure workstation OS that exists atm. SpectrumOS looks promising as a potential next gen too.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#160

Post by sargstuff »

thr717272 wrote: post #64
amelius wrote: post #20

Earlier quoted context omitted.

Do you lock your computer every time you leave your desk? And do you always check for keylogger thumbdrives and such?

Lock my computer: Always[1][2]. Check for keylogger thumbdrives: I use a laptop so it would be immediately obvious. But now that you say it I haven't checked the charger USB-outlet on the back of my cabled keyboard. [1]: it has happened I have failed. Once a year or something. [2]: I sometimes try to allow myself to go downstairs in my own house to fetch a cup coffe without locking when I am alone, but I find it so s…

> [2]: .....

Ah, no mention of water proofing computer to protect against robotic dog innocently spilling moring coffee/tea on computer.

Post reply on HN